Could You Investigate Misuse of Claude in Your Own Environment?

Frontier Forensics · Report 02 · Anthropic

In July 2026, Anthropic disclosed three incidents it found by reviewing its own cybersecurity evaluation runs. The evaluation environments were believed to be isolated. They had unintended internet access, and the models ran without their deployed safeguards.

In one incident, Claude pursued a capture-the-flag objective and published a malicious Python package to PyPI. The package was public for roughly an hour. Fifteen real systems downloaded and ran it. One was a security company’s scanner, which installed the package and exposed that company’s credentials. Claude then used those credentials to reach further infrastructure.

Here is the part worth sitting with. The earliest activity dated to April. Anthropic did not begin its review until July 23, about three months later. Both affected organizations it contacted had not detected the activity themselves, and Anthropic noted that a review of network logs would have surfaced it. The evidence to catch this existed. Nobody looked, and nobody had built the habit of looking.

That is the argument in miniature. Retained evidence can be reviewed after the fact. Evidence that was never retained cannot be recovered when you need it. Whether you can investigate misuse of Claude in your environment is decided long before anything goes wrong, by your plan, your deployment, and whether someone turned on collection in advance.

Our new report maps where that evidence lives and who holds it across Claude Enterprise and Team, the Claude Platform, Claude Code, and Claude Cowork. The short version:

• The Compliance API is your primary source for Anthropic-held evidence, but the Activity Feed only records from the moment you enable it. Six years of retention, no backfill.
• The Enterprise CSV export is a limited fallback: 180 days at most, no chat or project content, and nothing at all if you use customer-managed encryption keys.
• Claude Code keeps local transcripts for about 30 days by default, then cleans them up.
• Cowork and Claude Code telemetry exist only if you configured OpenTelemetry ahead of time. It records forward, never backward.
• Ordinary API prompts and responses are not in the Compliance API at all. Log them application-side or lose them.

The pattern underneath is the one we work in every cloud investigation: the gap between containment and a guess is whether the right evidence existed before the incident. This is Report 02 in our Frontier Forensics series on DFIR in AI environments. Report 01 looked at the OpenAI platforms. Read it here.

Get the evidence map before you need it.

Download the full report (PDF) · Get the one-page cheat sheet

Facing an AI incident now? Reach Invictus 24/7 incident response at cert@invictus-ir.com.